/
← Voltar ao feed
high retail food and agriculture healthcare pharmaceuticals manufacturing logistics

Forescout warns of 6,017 exposed refrigeration control IPs after October 2026 attacks on French supermarkets

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 11:08 · coletado há 10 horas

Forescout's Vedere Labs published research on internet-exposed refrigeration control systems after reported October 2026 cyberattacks that disrupted refrigeration at hundreds of French supermarkets, causing temperature fluctuations and spoiled stock. The researchers observed 12,976 exposed service observations across ten product groups, tied to 6,017 distinct public IP addresses in 99 countries and territories. These figures count exposed services, not confirmed compromised devices. Forescout has tracked more than 20 claimed attacks on refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active. The initial access method and the identity of those behind the French attacks have not been confirmed.

Detalhes técnicos

  • Observations by product: Copeland/Dixell XWEB 7,075; Danfoss StoreView 4,697; Copeland Site Supervisor 551; Carel pCOWeb 513; 140 across six other product groups.
  • 3,762 Danfoss StoreView observations (80%) ran firmware older than 4.3.1, making them potentially vulnerable to two previously disclosed flaws (CVE IDs not given in the article).
  • Recurring problems: publicly accessible management interfaces, outdated firmware, weak authentication and poor visibility of contractor-installed equipment.
  • Attackers with access can change temperature settings, interfere with defrost cycles or disrupt equipment using legitimate management functions, without malware. This makes the activity hard to tell apart from routine maintenance.
  • A Danfoss technical bulletin attributes 2022 hacktivist attacks to 16 Russian supermarkets and 40 stores in Israel.
  • Targets of the 2026 claimed attacks include supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.
  • Refrigeration and temperature control are also used in healthcare, pharmaceuticals, manufacturing and logistics.

Remediação

  • Remove publicly accessible management interfaces.
  • Replace unsupported equipment and apply available security updates.
  • Provide secure remote access for maintenance contractors.
  • Enforce multifactor authentication and individual user accounts.
  • Continuously monitor for suspicious changes to temperature settings, defrost schedules and alarms.
  • Maintain visibility of connected devices, who can access them and what changes they can make.

Linha do tempo

  1. itsecurityguru.org ↗ · pub. 22/10/2026 11:08 · coletado 22/10 13:00 primeiro registro

    Forescout warns of 6,017 exposed refrigeration control IPs after October 2026 attacks on French supermarkets

    ler a análise desta fonte

    Forescout's Vedere Labs published research on internet-exposed refrigeration control systems after reported October 2026 cyberattacks that disrupted refrigeration at hundreds of French supermarkets, causing temperature fluctuations and spoiled stock. The researchers observed 12,976 exposed service observations across ten product groups, tied to 6,017 distinct public IP addresses in 99 countries and territories. These figures count exposed services, not confirmed compromised devices. Forescout has tracked more than 20 claimed attacks on refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active. The initial access method and the identity of those behind the French attacks have not been confirmed.

    Technical Details

    • Observations by product: Copeland/Dixell XWEB 7,075; Danfoss StoreView 4,697; Copeland Site Supervisor 551; Carel pCOWeb 513; 140 across six other product groups.
    • 3,762 Danfoss StoreView observations (80%) ran firmware older than 4.3.1, making them potentially vulnerable to two previously disclosed flaws (CVE IDs not given in the article).
    • Recurring problems: publicly accessible management interfaces, outdated firmware, weak authentication and poor visibility of contractor-installed equipment.
    • Attackers with access can change temperature settings, interfere with defrost cycles or disrupt equipment using legitimate management functions, without malware. This makes the activity hard to tell apart from routine maintenance.
    • A Danfoss technical bulletin attributes 2022 hacktivist attacks to 16 Russian supermarkets and 40 stores in Israel.
    • Targets of the 2026 claimed attacks include supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.
    • Refrigeration and temperature control are also used in healthcare, pharmaceuticals, manufacturing and logistics.

    Remediation

    • Remove publicly accessible management interfaces.
    • Replace unsupported equipment and apply available security updates.
    • Provide secure remote access for maintenance contractors.
    • Enforce multifactor authentication and individual user accounts.
    • Continuously monitor for suspicious changes to temperature settings, defrost schedules and alarms.
    • Maintain visibility of connected devices, who can access them and what changes they can make.